General
-
Target
3068-95-0x0000000000400000-0x0000000001462000-memory.dmp
-
Size
16.4MB
-
MD5
0ff02d8010adf4d639d7d67f5a7139d7
-
SHA1
4bee3a993e276cb7cfb086f67fd36a001128c2b7
-
SHA256
5c3e09ab2b1d5faf2d710231e3d96860e2a42c02f735612b8e0940d33c47b2d5
-
SHA512
5ee9d6216ee71dfb8b03feff1f65c82e14c90cae34a0f90e4a902b67c93c08dc65ad60a0aca0c00e79cd23193221b9cbf0b95774329159264bf5f65859bc9efb
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqvIzmd:nSHIG6mQwGmfOQd8YhY0/EOUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://216.128.145.196/~wellseconds/?p=402745504347861
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3068-95-0x0000000000400000-0x0000000001462000-memory.dmp
Headers
Sections